Topic: ZyXEL P-2812HNU-F1 Unbranding Process
I finally got it: I unbranded or changed the firmware from my ZyXEL P-2812HNU-F1 router. Now working with this router and firmware version 3.11(TUJ.0)C0 I previously downloaded from ZyXEL FTP server.
All you need is:
RJ45 LAN cable
Tera Term Pro for Windows®
TFTPD32 , a TFTP Server
The procedure is as follows:
Unmount front panel of ZyXEL P-2812HNU-F1 using screwdriver
Connect FTDI TTL cable (just GND, TX and RX cables are needed) to the router board as indicated in the following image
Observe GND pin as reference pin (isolated pin).
Connect FTDI USB cable to PC and install drivers.
Connect LAN1 port of router to your PC LAN port usign RJ45 cable.
Configure PC LAN adapter:
IP Address: 192.168.1.X (where X is in the range of 2 to 255)
Subnet mask: 255.255.255.0
Start Tera Term Pro and configure serial port:
Port: (see serial ports in Computer Management/Device Management)
Baud rate: 115200
Data: 8 bit
Stop: 1 bit
Flow control: none
Power up the router andstop start up sequence by pressing any key.
You should see ZyU console like
Note: All AT commands (ATSH, ATSE, ATEN, ...) will be executed in Tera Term Pro, that is in ZyU console.
Configure to bind TFTP server to PC LAN port (192.168.1.X)
Copy bootbase file 304TUJ.bm and frimware file 311TUJ0C0.bin to TFTP Base Directory folder (where send/receive files are stored)
Execute ATSH command
Take note of Serial number and First MAC address values
Execute ATSE P-2812HNUL-F1 command
Where P-2812HNUL-F1 is the x argument of ATSE command.
You will obtain a 12 digit seed number
Execute ZynPass.exe windows application
Introduce previous seed number provided by ATSE command in seedNumber field, then push Generar button and obtain the password for ATEN command in Password field
Execute ATEN 1,password command
Where password is the password we previously obtained in step 11.
This command activates Enable Debug Falg.
Execute ATBT 1 command.
This command unlocks block0 in flash memory where bootloader resides.
Execute ATUB 304TUJ.bm command.
This command uploads bootbase file from TFTPD Base directory folder to the router, erases the block0 flash and writes new bootbase
Execute ATUR 311TUJ0C0.bin command
This command uploads firmware file from TFTP Base directory folder to the router, erases the flash and writes new firmware
Restart the router (switch off and then switch on)
Now it's necessary to customize the serial number and the MAC address to match label in the router.
Repeat steps 7 and 13 to get access to ZyU console
Observe Debug Falg is enable in the new boobase, by default.
Execute ATCB command
This command copies manfacturer data from flash rom to working buffer (RAM)
Execute ATSN SerialNumber command
Where SerialNumber is the Serial number obtained in step 9
This command changes serial number in working buffer to the right one in the router label/stick
Execute ATWM MACAddress command
Where MACAddress is the First MAC address obtained in step 9
This command changes MAC address in working buffer to the right one in the router label/stick
Execute ATSB command
This command saves customized data in working buffer to flash rom.
Available AT commands in ZyU console should be:
ZHAL> ATHE ATBT x block0 write enable (1=enable, 0=disable) ATWM x set MAC address in working buffer ATEN x,(y) set BootExtension Debug Flag (y=password) ATSE x show the seed of password generator ATWZ a(,b,c) write ZyXEL MAC addr, Country code, EngDbgFlag ATCB copy from FLASH ROM to working buffer ATCL clear working buffer ATSB save working buffer to FLASH ROM ATBU dump manufacturer related data in working buffer ATSH dump manufacturer related data in ROM ATCO x set country code in working buffer ATFL x set EngDebugFlag in working buffer ATVD x set vendor name in working buffer ATPN x set product name in working buffer ATFE x,y,... set feature bits in working buffer ATSN x set serial number in FLASH ROM ATTL MRD_CERT & ROM-D partition utility ATGO boot up whole system ATGU go back to U-Boot command line mode ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations ATMI x Enable/Disable model ID checking (1=enable, 0=disable) ATUR x upgrade RAS image (filename) ATUB x upgrade ZyU-Boot image (filename) ZHAL>